diff options
| author | Christoph M. Becker <cmb@php.net> | 2015-07-18 22:48:54 +0200 |
|---|---|---|
| committer | Christoph M. Becker <cmb@php.net> | 2015-07-18 22:48:54 +0200 |
| commit | 8c483ce36cb07d7e986484da93cf064ad1cc9dd7 (patch) | |
| tree | 470068f97147acbdfa358ff61b2298849a2c475c | |
| parent | a66efb0b154236e63f98b95bd12bc31fea90500c (diff) | |
| download | php-git-8c483ce36cb07d7e986484da93cf064ad1cc9dd7.tar.gz | |
Fix #70096: Repeated iptcembed() adds superfluous FF bytes
When there is already an APP13 marker segment in the file, iptcembed() doesn't
skip the first byte (0xFF) of this segment, what leads to unnecessary and
potentially invalid duplication of this byte. This patch fixes this issue.
| -rw-r--r-- | ext/standard/iptc.c | 1 | ||||
| -rw-r--r-- | ext/standard/tests/image/bug70096.phpt | 31 |
2 files changed, 32 insertions, 0 deletions
diff --git a/ext/standard/iptc.c b/ext/standard/iptc.c index 05d778b41b..169ee96d35 100644 --- a/ext/standard/iptc.c +++ b/ext/standard/iptc.c @@ -236,6 +236,7 @@ PHP_FUNCTION(iptcembed) case M_APP13: /* we are going to write a new APP13 marker, so don't output the old one */ php_iptc_skip_variable(fp, 0, 0 TSRMLS_CC); + fgetc(fp); /* skip already copied 0xFF byte */ php_iptc_read_remaining(fp, spool, poi?&poi:0 TSRMLS_CC); done = 1; break; diff --git a/ext/standard/tests/image/bug70096.phpt b/ext/standard/tests/image/bug70096.phpt new file mode 100644 index 0000000000..1674d07a73 --- /dev/null +++ b/ext/standard/tests/image/bug70096.phpt @@ -0,0 +1,31 @@ +--TEST-- +Bug #70096 (Repeated iptcembed() adds superfluous FF bytes) +--SKIPIF-- +<?php +if (!extension_loaded('gd')) die('skip gd extension not available'); +?> +--FILE-- +<?php +$filename = __DIR__ . '/bug70096.jpg'; +$im = imagecreatetruecolor(10, 10); +imagejpeg($im, $filename); +imagedestroy($im); +$data = "\x1C\x02x\x00\x0ATest image" + . "\x1C\x02t\x00\x22Copyright 2008-2009, The PHP Group"; +$content1 = iptcembed($data, $filename); +$fp = fopen($filename, "wb"); +fwrite($fp, $content1); +fclose($fp); +$content2 = iptcembed($data, $filename); +$fp = fopen($filename, "wb"); +fwrite($fp, $content2); +fclose($fp); +var_dump($content1 === $content2); +?> +--CLEAN-- +<?php +$filename = __DIR__ . '/bug70096.jpg'; +@unlink($filename); +?> +--EXPECT-- +bool(true) |